“Based on a catastrophic incident as the worst-case scenario, teams need to consider how long the restoration times of services may take, including collecting forensic information. Without an effective role-playing implementation, an hour-long meeting in a conference room to review an incident response plan will never reveal the true pain of an outage that could last days if domain controllers, virtual instances, and infrastructure needs to be restored.”